An Android banking trojan called RatHat now uses Google's Gemini model to estimate how much money each victim has and to rank infected phones accordingly, according to research by security firm Cleafy that The Hacker News reported Monday. Cleafy counted about 100 deployments of RatHat's control console since April 2026.

What Happened

RatHat is sold as malware-as-a-service, with a separate console instance for each customer. On infected phones it collects text messages and captures passwords through fake banking login screens laid over legitimate apps.

The newest console sends those harvested messages to Gemini and asks it to estimate the victim's bank balance, then sorts devices into high-value and mid-value groups. The latest version works only with Gemini and directs operators to Google AI Studio to obtain an API key. RatHat also calls Gemini from the infected phone itself, using an API key stored in its settings, sending the layout of the screen and asking where to tap. Cleafy did not find automated money transfers in the samples it examined, so the model's role is to help operators prioritize rather than to steal on its own.

RelatedFBI Warns Scammers Are Using AI to Impersonate Candidates Ahead of the Midterms

To get deeper control, RatHat requests Android's Accessibility permission and uses it to switch on wireless debugging and connect through the Android Debug Bridge. That gives the operator shell-level access that ordinary app permissions do not allow. A console button deploys a Go program that uses the minicap and minitouch tools to stream the screen and send taps without the permission prompt or recording icon that Android's own screen capture shows. Those tools do not work on Android 14 and later, where the malware falls back to the app's standard screen capture and its permission prompt.

Why It Matters

Each RatHat customer runs its own console and must choose which infected phones to work on by hand. Handing the harvested text messages to a commercial language model to estimate a balance is a cheap way to decide which devices deserve an operator's attention first. The same approach can be applied to any stolen text data, and it requires no model training by the criminals, only an API key.

The ADB technique is also notable. By turning Accessibility access into debugging access, RatHat gets around the permission model that is supposed to limit what an app can do, and the minicap route lets operators watch a screen without the visible indicator a victim might notice on older devices.

The Hacker News article does not include a statement from Google about the use of its API.

Infrastructure and Lineage

Cleafy linked samples from late 2025 and February 2026 to an earlier console called Fisher. Three newer versions, all built from the same code, were in use between April and September 2026: one calling itself BlackCat Remote Control Management, followed by Panda Workshop V5 and V6. Nearly half of the observed IP addresses sat on AS4907, a Singapore-registered network. The malware spreads through text messages and online ads that point to download sites outside official app stores.

What to Watch

  • Whether Google revokes the API keys or accounts behind RatHat's Gemini use, or adds abuse detection to AI Studio keys.
  • Whether later RatHat versions move from ranking victims to automating transfers.
  • Android users should avoid installing apps from links in texts or ads, and should be wary of any app that asks for Accessibility access.
  • Whether other banking malware families adopt similar LLM-based triage.